EnCE Memory Forensics & Volatile Data Analysis

Question 1

Which type of data is lost when a computer is powered off and is therefore considered volatile?

Accepted Answer

Contents of the RAM

Answer

RAM (Random Access Memory) is volatile storage, meaning its contents are lost when power is removed from the system.

Question 2

In EnCase, which feature is used to acquire a live memory image from a running Windows system?

Accepted Answer

EnCase Physical Memory Acquisition

Answer

EnCase Physical Memory Acquisition allows examiners to capture a snapshot of RAM from a live running Windows system.

Question 3

What is the primary reason an examiner should acquire volatile data before shutting down a suspect's computer?

Accepted Answer

To capture running processes, network connections, and encryption keys

Answer

Volatile data such as active processes, open network connections, logged-in users, and encryption keys only exist in RAM and are lost on shutdown.

Question 4

Which of the following artifacts can typically be found in a memory dump but NOT on the hard drive?

Accepted Answer

Decrypted BitLocker volume keys

Answer

BitLocker encryption keys are held in RAM while the volume is mounted and decrypted, but are never stored on disk in plaintext.

Question 5

What file extension does EnCase typically use for a captured physical memory image?

Accepted Answer

.E01

Answer

EnCase stores acquired memory images in the Expert Witness Format (.E01), the same container used for disk images.

(EnCE) EnCase Certified Examiner Practice Test